Insertion of Sensitive Information into Log File
CWE-532
The product writes sensitive information to a log file.
We track 193 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.8. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
Latest Insertion of Sensitive Information into Log File vulnerabilities
- 7.5 High severity
App Connect Operator: Insertion of Sensitive Information into Log File
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sensitive information about the deployed environment within error messages.
- 7.3 High severity
bosh-openstack-cpi-release: Insertion of Sensitive Information into Log File
The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
- 7.5 High severity
Terraform Provider for PowerStore: Insertion of Sensitive Information into Log File
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit t
- 8.8 High severity
Terraform Provider for ObjectScale: Insertion of Sensitive Information into Log File
Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileg
- 7.0 High severity
zizmor: Insertion of Sensitive Information into Log File
zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB
- 7.1 High severity
API Connect: Insertion of Sensitive Information into Log File
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive credentials and compromise accounts due to insertion of sensitive information into log files.
- 8.8 High severity
C-CURE 9000, Victor: Insertion of Sensitive Information into Log File
Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of Known Operating System Credentials. This issue affects C-CURE 9000, Victor: 3.20.
- 8.8 High severity
openhuman: Exposure of Sensitive Information to an Unauthorized Actor
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted
- 10.0 Critical severity
Apache Juneau: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers s
- 8.2 High severity
loggingredactor: Insertion of Sensitive Information into Log File
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such
- 7.5 High severity
zuke: Insertion of Sensitive Information into Log File
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in c
- 8.2 High severity
n8n: Insertion of Sensitive Information into Log File
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential
- 7.7 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successf
- 8.1 High severity
Apache Answer: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and
- 7.5 High severity
MarkLogic Server: Insertion of Sensitive Information into Log File
On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in diagnostic logs under certain configurations. An attacker with access to the affected logs c
- 8.1 High severity
MarkLogic Server: Insertion of Sensitive Information into Log File
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain u
- 7.5 High severity
Apache Geode: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
- 8.4 High severity
Router: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Rout
- 7.7 High severity
Container Storage Modules: Insertion of Sensitive Information into Log File
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure
- 7.8 High severity
Armatura One: Insertion of Sensitive Information into Log File
Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to the serve
- 7.3 High severity
contrast: Insertion of Sensitive Information into Log File
Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONTRAST_LOG_LEVEL set to info or debug. Because info is the default, all installations that do not custo
- 7.3 High severity
contrast: Insertion of Sensitive Information into Log File
Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response — which contains the workload secret — to standard output at INFO level. As a result, workload secrets
- 8.4 High severity
SANnav: Insertion of Sensitive Information into Log File
Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these k
- 8.5 High severity
SANnav: Insertion of Sensitive Information into Log File
Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can vi
- 8.5 High severity
SANnav: Insertion of Sensitive Information into Log File
Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or suppo
- 7.8 High severity
Command Powershell Provider (DCPP): Insertion of Sensitive Information into Log File
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclo
- 7.1 High severity
jupyter_server: Insertion of Sensitive Information into Log File
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A reque
- 8.8 High severity
admin3: Insertion of Sensitive Information into Log File
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bea
- 10.0 Critical severity
Apache Storm Nimbus: Insufficiently Protected Credentials
Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only t
- 7.5 High severity
Apache Syncope: Insertion of Sensitive Information into Log File
Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue
- 7.7 High severity
Tooling: Insertion of Sensitive Information into Log File
The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (
- 7.7 High severity
renovate: Insertion of Sensitive Information into Log File
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomple
- 8.8 High severity
siyuan: Insertion of Sensitive Information into Log File
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and ga
- 9.3 Critical severity
Dimension: Exposure of Sensitive Information to an Unauthorized Actor
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in
- 7.5 High severity
openssl_encrypt: Insertion of Sensitive Information into Log File
openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g. -apHunter2) or abbreviated long-option spellings (e.g. --passw). The sanitizer only recognized exact
- 8.8 High severity
FDS 102: Insertion of Sensitive Information into Log File
A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Insertion of Sensitive Information into Log File
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the to
- 7.5 High severity
App Connect Enterprise: Insertion of Sensitive Information into Log File
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.
- 8.1 High severity
frigate: Improper Privilege Management
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials